Auto mode: let a classifier block fall back to a permission prompt instead of a hard deny

**Problem**

In auto mode the classifier has two outcomes: allow or block. When it blocks, the model receives `automode-blocked` and cannot recover. In practice it then tells the user "run these commands yourself in the terminal", which defeats the purpose of the session.

Concrete case (Claude Code 2.1.261, desktop app): I explicitly asked to release a package. The model prepared everything, then ran

```
git push origin develop v0.42.0
```

The classifier blocked it (tag push = PyPI publish). The action was exactly what I had requested; I would have confirmed it in one click. Instead I got three commands to paste into a terminal.

**Workarounds today, and why they are not enough**

- `permissions.ask` rules take precedence over the classifier and prompt. But they need a pattern written in advance for every risky command shape (`git push origin v*` did not match `git push origin develop v0.42.0`). The classifier already identifies the risky action at runtime; the rule duplicates that judgment statically.
- A PreToolUse hook returning `permissionDecision: "ask"` has the same limitation.
- `/auto-mode-setup` steers the classifier's judgment, but a block still ends in a hard deny.

**Request**

Give the classifier's "block" outcome a configurable disposition, for example:

```json
"permissions": { "autoModeOnBlock": "ask" }
```

with values `deny` (current behaviour, default) and `ask` (show the ordinary permission prompt with the classifier's reason attached). Alternatively, or in addition, a button on the block notification: "Ask me instead" / "Allow once".

**Why it matters**

- The user is present in an interactive session; a prompt costs one click, a hard deny costs a context switch and manual retyping.
- The classifier's reason is already computed; surfacing it in the prompt makes the decision better informed than a static `ask` rule.
- Unattended runs keep `deny` as default, so nothing changes for them.

Start at the auto-mode block path that emits `automode-blocked`, then trace how `permissions.ask` and the ordinary permission prompt are handled. Compare `/auto-mode-setup` and the PreToolUse `permissionDecision: "ask"` path; done means a configurable `autoModeOnBlock` deny/ask behavior preserves deny by default and carries the classifier reason into the prompt, with coverage for interactive and unattended cases.

Vom Indexierungsmodell aus dem Issue-Text verfasst.